Recital 17

The results of risk assessments should be made available to obliged entities in a timely manner to enable them to identify, understand, manage and mitigate their own risks. Those results can be shared in a summarised form and made available to the public, and should not include classified information or personal data.